The vulnerability is a flaw in Cisco License On‑Prem that allows code injection due to insufficient input validation, grouping under CWE‑94. If an attacker can supply malicious input, the application may execute arbitrary code, compromising confidentiality, integrity, and availability of the system.

Affected product is Cisco License On‑Prem, formerly Cisco Smart Software Manager On‑Prem. No specific version information appears in the advisory; the vulnerability was identified as part of an internal security review.

The CVSS score of 8.8 reflects a high severity assessment. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The likely attack vector is from exposed interfaces that accept user input, as inferred from the description of insufficient protection against code injection. If leveraged, an attacker could achieve remote code execution if the attack surface is reachable.